TI-2024-38575 Aliases GHSA-r95h-9x8f-r3f7

Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459

LOW 38CWE-120Published 2024-05-13 · Updated 2024-05-15

Key facts

Attack vector: —
Privileges required: —
User interaction: —
Attack complexity: —
Impact type: —
Confidentiality · integrity · availability: —
Fix status: Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

## Summary Nokogiri v1.16.5 upgrades its dependency libxml2 to [2.12.7](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.7) from 2.12.6. libxml2 v2.12.7 addresses CVE-2024-34459: - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/720 - patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/2876ac53 ## Impact There is no impact to Nokogiri users because the issue is present only in libxml2's `xmllint` tool which Nokogiri does not provide or expose. ## Timeline - 2024-05-13 05:57 EDT, libxml2 2.12.7 release is announced - 2024-05-13 08:30 EDT, nokogiri maintainers begin triage - 2024-05-13 10:05 EDT, nokogiri [v1.16.5 is released](https://github.com/sparklemotion/nokogiri/releases/tag/v1.16.5) and this GHSA made public

Why it matters now

Fix Fixed nokogiri (RubyGems): 1.16.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	nokogiri (RubyGems)	before 1.16.5	1.16.5	Patch available	GHSA-r95h-9x8f-r3f7

nokogiri (RubyGems) Vendor— Affected before 1.16.5 Fixed in 1.16.5 Patch available GHSA-r95h-9x8f-r3f7

Remediation

Fix · GHSA-r95h-9x8f-r3f7 nokogiri (RubyGems) Fixed in 1.16.5 Advisory →

Timeline

2026-10-03 Threatist record created from GHSA-r95h-9x8f-r3f7

References

Other 6

Sources

GHSA-r95h-9x8f-r3f7 · GitHub Advisory Database · CC BY 4.0

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences